24 ms·

Russians Engineer a Slot Machine Cheat that Casinos Can't Fix

391 points by arielm 10y ago

FloatingGhost 10y ago
This is about as clickbaity as any headline can get
mnarayan01 10y ago
The "And Casinos Have No Fix" part of the title seems exaggerated; if nothing else, it appears that only a small subset of 5+ year old machines are affected.
- fifnir 10y ago
  And casinos can have people arrested over this so that's another fix
- muninn_ 10y ago
  Casinos HATE him!
- rtkwe 10y ago
  From the description of the attack it seems like the only reason other machines aren't affected is because the Russian group running this hasn't gotten their hands on those machines.
  - goda90 10y ago
    It also mentions machines with encryption to prevent reverse engineering the PRNG.
    - hydrogen18 10y ago
      If that encryption works as good as other DRM and copy-prevention schemes, I'm sure it will protect the machine for at least 72 hours.
      - baobrien 10y ago
        eh, well designed CSPRNGs are a thing. If they re-seed/add to the entropy pool of the machines on the LSBs of microsecond button timing or something like that, it'll be pretty difficult to influence or predict the outputs.
  - orclev 10y ago
    Sort of maybe. It sounds like the slot machine makers are being cheap with their machines. There are such things as hardware RNG that will produce a truly random number, it's just that for most applications they're overkill. This seems like an instance where not only aren't they overkill, they're almost mandatory. They talk a bit about using encryption to protect the PRNG algorithm, but that's just a bandaid, at best it buys them a little bit of time, but ultimately it will be cracked the same way. A hardware RNG is actually pretty cheap to make, there are actually open source (as in the circuit diagrams are available) ones floating around the internet that you can build for less than $20 worth of parts. The manufacturers probably don't want to go that far because a) compared to most of the parts in the machine it's a fairly expensive piece so it will cut into profits, b) hardware RNG function a bit different from a PRNG so properly integrating one requires a certain amount of skill, c) it isn't their problem really, they already got their money, it's the casinos that are losing, and d) it's simpler to just prosecute the handful of people doing this (for now).
    - cwmma 10y ago
      e) it's much harder to be sure a hardware RNG actually does produce random outputs compared to a PRNG
      - orclev 10y ago
        That was somewhat covered by point b, but yeah, in terms of verification it's tricky to determine if a hardware RNG is actually, you know, random. The other part that makes it tricky is that most hardware RNGs don't produce enough entropy to keep a system fed during active usage so you typically need to use their outputs as inputs to more traditional PRNGs or to periodically re-seed a PRNG which was actually the main thing I was thinking about with point b.
- kyteland 10y ago
  It absolutely is exaggerated. I left a job at a real money slot manufacturer 3-ish years ago where I was a mathematician and 'the rng guy'. Even then our machines weren't susceptible to this attack. We had a fix. And by 'weren't susceptible' I mean probably weren't but could be, because getting the rng wrong is super easy to do. Don't be shocked if regulators just pull these from the floor. They probably had to go through a lot of different machines from different manufacturers to find this in the first place.
Cyph0n 10y ago
It's still unclear how the organization broke the PRNG in the first place. Were they somehow able to get their hands on a machine for hardware analysis? Or did they just have their "operatives" play slots and capture video which they then manually analysed for patterns? Offloading the computation to a remote server is a smart idea though. There is a lot of cool stuff happening in the game cheating space.
- Xylakant 10y ago
  Yes they did. Says so in the article.
  - Cyph0n 10y ago
    Ah, must have missed it.
- tastythrowaway 10y ago
  FTA it says that used machines proliferated at cheap prices after a 2009 country-wide ban on most forms of gambling.
  - Cyph0n 10y ago
    I would assume that used machines are either destroyed by the manufacturer or resold only to licensed entities.
    - omgtehlion 10y ago
      Machines were sold in Russia, and at the day the gambling codex contained only one chapter: 1. Gambling is banned So, these casinos dumped machines as fast and as cheap as they can
    - throwaway2048 10y ago
      when gambling just got banned nationally, you have very little incentive to maintain good relations with the manufacturer, and would rather just get whatever you can moneywise for such a large investment.
moftz 10y ago
At what point does a scheme like this go from just being a way to outsmart the slot machine to felony fraud? I know you are allowed to use those blackjack cheat cards at the tables in Las Vegas but what if I started using a calculator and my own crazy algorithm? Is that fraud? What if I had an ear piece and hidden camera glasses to stream video to some blackjack guru outside in a van? I'm guessing that would be fraud. Is it the fact that he's using an outside source to determine his actions?
- upofadown 10y ago
  Here is a section of the Nevada gambling fraud law that hits close to a method that involves button timing: >7. To manipulate, with the intent to cheat, any component of a gaming device in a manner contrary to the designed and normal operational purpose for the component, including, but not limited to, varying the pull of the handle of a slot machine, with knowledge that the manipulation affects the outcome of the game or with knowledge of any event that affects the outcome of the game. In general you are not allowed to do anything clever in a casino. It isn't stated as such, but the actual crime is winning consistently. If you walk into a casino certain that you will not be providing the house with their cut then you will almost for sure run up against some law. Extra laws will be generated as required by the governments involved.
  - usrusr 10y ago
    Key word being "knowledge". Seems like you are free to believe in any fantasy about you having an edge over the house, except when that belief happens to be true. The mere thought of having a streak of luck would make winning illegal. If thoughtcrimes were animals, this would be a cute little kitty.
    - Bartweiss 10y ago
      > Seems like you are free to believe in any fantasy about you having an edge over the house, except when that belief happens to be true. This is a pretty common pattern in "intent" crimes. As a simple example: attempted murder requires a potentially-effective plan. Shooting at someone and missing is attempted murder, burning a voodoo doll of them is not - no matter how sincerely you expect it to work. It does produce an odd situation where stupidity becomes a legal defense, but the basis for it is pretty understandable. It's not criminalizing being right, it's decriminalizing being wrong, presumably because it's too hard to define the boundaries of whether something useless was done with real intent.
CapacitorSet 10y ago
Saved you a click: the internal state of some slot machines' PRNG can be predicted after observing a few of its outputs.
- artursapek 10y ago
  I know I have read stories about this technique being used before. Doesn't it require special hardware and impeccable timing on your person to take advantage of it?
  - matheweis 10y ago
    Article indicates that an iphone is the special hardware. It also handles the timing, even preemptively signals the player when to go based on his/her reaction time. Timing doesn't have to be perfect - only enough to offset the house edge.
    - macintux 10y ago
      Well, iPhone is the viewing mechanism for engineers on the other side of the world to do the real work.
      - netsharc 10y ago
        Interesting how they're doing it, I guess making an app with image recognition takes too much effort, and having all the logic in an app makes it easier for your fellow thief to go independent and not give you your cut. I guess an app that requires login would be possible.
        macintux 10y ago
        IIRC the iPhone processing power is inadequate.
        bourbonfiber 10y ago
gwbas1c 10y ago
I wonder if there's enough variation in how people pull the handles and push the buttons that they could be used to partially re-seed the PRNG frequently enough that it the seed can't be determined by a video?
- CapacitorSet 10y ago
  That's the technique Linux uses, it feeds keyboard and mouse timing events into one of its entropy pools. I can't see why they wouldn't do this for slot machines.
  - manarth 10y ago
    The article mentions newer slot machines, "whose PRNGs use encryption to protect mathematical secrets" - so new machines are already considered secure. Aristocrat, Novomatic, and any other manufacturers whose PRNGs have been cracked “would have to pull all the machines out of service and put something else in, and they’re not going to do that.” So they could be fixed, it's purely a financial decision. as long as older, compromised machines are still popular with customers, the smart financial move for casinos is to keep using them and accept the occasional loss to scammers.
    - lsaferite 10y ago
      Seems like using a radioactive decay RNG would also help, no?
      - thecatspaw 10y ago
        sure, but are you gonna put a tiny bit of radioactive material in every slot machine? Not to forget that the RNG would have to be restocked if the material ever runs out
        orclev 10y ago
        Pretty sure the half-life of most things that would be used is already longer than the MTBF of just about every other part a slot machine.
bitexploder 10y ago
There is a fix and it is not crazy. The gist is they were able to brute force the PRNG of the machines and predict their future state. Hardware RNG is thr answer. In crypto it is obviously bad if someone can predict anything about your random values (keys / IVs). A hardware RNG, "cryptographically strong" RNG algorithms, and resetting the RNG very often make this problem go away.
- klodolph 10y ago
  You might be interested in seeing the legal requirements. Section 1.400: http://gaming.nv.gov/modules/showdocument.aspx?documentid=2919 http://gaming.nv.gov/modules/showdocument.aspx?documentid=29...
  - bitexploder 10y ago
    That is a surprisingly detailed and reasonable requirement for the most part. Some of those side channel attack resistant requirements are wishful thinking in some ways, but it is also probably obvious in general, if someone is say, performing DPA in the middle of your casino.
- bluGill 10y ago
  The problem is that you cannot add a hardware random number generator to existing machines and the cost of buying a new machine is high enough that casinos do not want to do it. If the scammers get too big the casinos will replace the compromised machines and the scam ends. The scammers seem to know this: they are targeting more an more casinos around the world in an apparent effort to make sure it is worth the risk. Actually you don't need hardware random number generators. There is enough variance in human input to feed a cryptograhic random number generator. The code to add this probably wouldn't be that hard to write (they might be 8 bit CPUs or some such limit that makes it impossible though). However all code changes have to be certified by regulatory bodies (for good reason) which makes it not worth the effort to fix old machines.
  - bitexploder 10y ago
ainiriand 10y ago
I would like to know what is morally wrong in defeating a system designed to beat you. Designed to (almost) always win. The Casino is the one that cheats because the odds are not completely random, as they should.
- unwind 10y ago
  I guess you're (as a player) supposed to know, understand, and support the fact that the house always wins. It is, after all, not free to build, staff and run a casino, so it would seem obvious that the money to do all that has to come from somewhere? You're simply not supposed to be able to win "too often". Sure, it would be better if it were truly a game of chance, I guess that's too difficult to deliver (and verify) at this point. Or, perhaps, the casinos prefer it this way of course. :)
  - tnzn 10y ago
    Except Casinos design the distribution of gains so that you're manipulated into believing it'll be worth, even though you rationnaly know that it's no true.
    - stinkytaco 10y ago
      This could be said for many things: food, alcohol, mobile pay-to-play games, etc, etc. The whole advertising industry is built on making you believe something will be worth it, regardless of rational thought. Seems unfair to single out casinos.
      - sydd 10y ago
        Not really, because slots and other casino games are much more deceiving. The whole thing is engineered so that you believe that you will win lots of money. But the reality is very different, this is how they must be built: - There is a state sanctioned minimum payout rate. This differs by state, but its between 80-90%. This means that on average you lose 80-90% of the $$$ you put in. - Slot machines cannot use conditional probability, in other words spins are independent. This means that the machine has no "memory" each spin is like rolling a dice. You dont have higher chance of payout just because you didnt won anything during the last hour. I've worked for a big slots company and we analyzed our customers a LOT. The big players (AKA whales) who drop thousands per month are not bored rich people in 99% of the cases, they are average people like you and me with a bad gambling addiction. And the state or the casino companies are doing nothing to help these people (why would casino companies care? This is where they are most of their revenue from). This is totally different from other fields - imagine if cigarettes would be advertised as something that makes you healthy and the state would be OK with it.
ptero 10y ago
Funny (and sad) how something that could be praised as an ingenious trick a hundred years ago is now considered a crime that state spends serious effort to pursue. Cannot resist to reference an older perspective (from Smoke Bellew): http://www.online-literature.com/london/smoke-bellew/4/ http://www.online-literature.com/london/smoke-bellew/4/
- LordKano 10y ago
  That was a great story. A little long but still great.
eykanal 10y ago
Not knowing much about video jamming, is it possible to block this hack by attacking the cameras?
- Cyph0n 10y ago
  I read a paper on such a technique a while back. The CMOS sensors in smartphones are very sensitive to a certain band of infrared. I think it would be possible to set up a system that automatically detects smartphone location and splashes its general area with infrared. With a good controller and motor setup, you could probably have a single jammer that can alternate between multiple phones.
  - joezydeco 10y ago
    And can be blocked with a small piece of infrared filter film.
    - Cyph0n 10y ago
      It depends on the threat model I guess. Whether or not such a system would work in a casino environment, I don't know.
jjuel 10y ago
The true fix is just to replace the machines. As they said the newer machines have encryption to hide the PRNG. Obviously some places can't do that, and the company is not doing it for free. So technically the casinos cannot fix the compromised machines themselves, but they could just replace them.
- Retric 10y ago
  If I know the PRNG and the encryption then I can predict the outcome of the encrypted PRNG. The encryption community has dealt with this issue for a long time and there are a lot of useful approaches, and many ways to fail.
  - falsedan 10y ago
    > If I know the PRNG and the encryption then I can predict the outcome of the encrypted PRNG. I assume they are mixing the PRNG output with a secret key using some encryption algorithm. Given the cyphertext (observed spins) + the algorithm, you still can't predict numbers until you discover the key.
    - Retric 10y ago
      Depends on the algorithm. Many encryption schemes are vulnerable if you know the cyphertext and can guess the plain text. This is one of those cases where if they knew what they where doing the PRNG would be fine as is. So, you can't just and wave some undefined encryption scheme and assume they will implement it correctly.
      - Scaevolus 10y ago
        Any cryptographic hash function works as a key derivation function (KDF) or cryptographically secure pseudo-random number generator (CSPRNG). Even ones with broken collision resistance are probably still suitable-- you could just take the bottom bits of MD5(secret_key + counter) and that would be enough.
linohh 10y ago
For the german speaking; here's a documentary about a guy who did this in the late 70ies in Germany - without an iPhone, just by developing a feeling for the (back then) mechanical machines. https://vimeo.com/169617086 https://vimeo.com/169617086 Fun fact: §263a StGB (German penal code) was in part created to combat this kind of externally assisted prediction for slot machines. It is now punishable with up to five years in prison, if you just create or distribute the software up to three years.
aaossa 10y ago
How does that encryption work? Is like those sha-256 circuits used in Bitcoin mining? Is it possible to modify the affected machines to allow encryption?
- y7 10y ago
  Yes, using SHA-256 you can create a cryptographically secure PRNG. See https://en.wikipedia.org/wiki/Cryptographically_secure_pseudorandom_number_generator https://en.wikipedia.org/wiki/Cryptographically_secure_pseud...
Aardwolf 10y ago
Since the title says "Can't Fix": Isn't it fixable by injecting some entropy into the PRNG for every roll like button press durations in nanoseconds, temperature, hardware quantum based, ...?
- mnw21cam 10y ago
  Yes. That costs money, and requires the machine to be re-certified by the authorities.
- digler999 10y ago
  you'd have to do a hardware mod, and gaming is a regulated industry. so every mod you do has to be submitted to a state or nationwide gaming regulatory authority, takes months (at least) to get approval, and costs easily $100k. Not to mention full regression testing on the statistics of the game. You would have to "re-prove" the validity of the RNG , which requires another QA cycle, statistical expert, and game designer (to ensure that the frequency and distribution of wins matches the specification sheet)
  - Aardwolf 10y ago
    Button timing might be doable with a software change only. Doesn't solve the other testing procedures of course. But what would be the difference with other casino software bugs then, are those also "Unfixable" then?
    - digler999 10y ago
      there aren't many other software bugs in casinos that affect the money. They're usually graphics-related or crashes, and they usually just restart the machine and write a bug report. If they are related to money, they pull the machine out of the field until a new software version is fixed. A gaming company I used to work at had an issue with multi-jurisdictional machines that worked in Mexico but could display english or spanish. The machines could also change denomination, say from $0.05 to $0.25. There was some bug where if you reset the power, you could get it to bump your credits up from 20 nickels to 20 quarters (or might have been 20 pesos to 20 cents), it was something dramatic and easily exploitable that was fixed promptly.
MR4D 10y ago
I would think that having 2 PRNGs and then switching between them would ruin this strategy. Obviously this would cost money for retrofitting, but all new slots could employ a new design, getting rid of this problem over a few years. Not a perfect solution, but at least it's a medium to long-term fix.
- DashRattlesnake 10y ago
  They already have a fix (better PRNGs), they just don't want to pay to implement it. "Use 2 PRNGs and switch between them somehow" sounds kinda like "roll your own encryption." This stuff is hard to get right, and iterating on quick-fixes without a deep understanding of the problem seems unlikely to do anything except introduce minor roadblocks for the attackers.
forgottenpass 10y ago
Slot machine outcomes are controlled by programs called pseudorandom number generators that produce baffling results by design. goddamnit wired. You're as bad as IT World. I don't know why I keep reading your trash.
- bluejekyll 10y ago
  They do an ok job of going on and explaining the limits of a PRNG. They're trying to target this to the broader market...
  - shepardrtc 10y ago
    I generally agree, but "baffling results" is just plain stupid. Might as well start talking about internet "tubes".
- amdavidson 10y ago
  Is this statement not literally correct? I believe the person being baffled in this is the gambler not the programmer.
- appleflaxen 10y ago
  What do you object to in that sentence?
- mturmon 10y ago
  $ python Python 2.7.8 (default, Oct 19 2014, 16:03:53) >>> import random >>> random.random() 0.10294460164979391 Why??? What does it mean?
problems 10y ago
Curious how they screwed this one up - did they just have no proper random source? Nothing like modern operating systems use, like disk latency? If you're in the business of doing random numbers, you'd think you'd embed a cheap hardware based random number generator, even if it was extremely limited, just to seed a CSPRNG.
- mark-r 10y ago
  I'm guessing that proper hardware random sources, or the operating system entropy generators, are harder to verify by gaming commissions so they didn't get used. The article does mention that more modern software uses cryptographic generators that can't be predicted.
peapicker 10y ago
Change to roulette, chaos theory, and physicists -- using 8bit hardware in shoes -- and you get the fascinating book "The Eudaemonic Pie" by Thomas Bass. Highly recommended.
- Zanni 10y ago
  Came here to say the same thing. Brilliant book. A team of physicists created a computer to track a roulette ball and wheel with sufficient accuracy to gain a whopping 40% advantage over the house. Their hardware was never reliable enough (in terms of not catching on fire, the predictions were good) to make much money. Doyne Farmer, a member of the team basically invented the field of chaos theory, then went on to make a fortune on Wall Street.
  - peapicker 10y ago
    I actually interned at Los Alamos Natl Lab at the Center for Nonlinear Studies while Doyne was there (late 80's - dating myself - before The Prediction Company). Cool guy! He had a nifty custom piece of hardware board for cellular automata in his computer that at the time blew me away. Was a cool job... got to write code that ran on things like Cray YMP supercomputers. Had a Thinking Machines CM-1 as well... (like in Jurassic Park with the blinkenlights).
technofiend 10y ago
A quick search of the inestimable comp.risks archives revealed this: http://catless.ncl.ac.uk/Risks/15/80#subj2 http://catless.ncl.ac.uk/Risks/15/80#subj2 Montreal -- Daniel Corriveau said he hopes that his 'victory over the system will give hope to others.' The computer analyst and his family received more than $620,000 [1C$ = U$0.75], including interest, from the Montreal casino yesterday, weeks after they overcame odds of one in six billion and beat an electronic keno game three times in a row." The author explains the following key points: o Corriveau used an "antique 286" computer to analyse 7,000 combinations from the keno game, [which uses an electronic pseudo-random number generator]. o Corriveau noticed that the electronic game was repeating numbers in a predictable pattern. o Corriveau and several family members bet on what they predicted would be due to come up; they won three times in succession. I had originally seen an article speculating someone power cycled a keno machine after recording the winning numbers, with the assumption or knowledge that the random number generator reseeded with a 0 on cold boot. I'm not sure if that's just me mis-remembering the details of this case, or another one altogether. If anyone has a link to the second case please let me know.
deleted 10y ago
[deleted]
RichardHeart 10y ago
Abusing humans desire to pattern find and take risks for profit is bad. Casinos are bad. If you could weaponize gambling and spread it in an enemy nation, you'd do much to hurt it's GDP. I made a video about why gambling sucks.
mark-r 10y ago
The title is a bit misleading (clickbait?) - the problem can certainly be fixed, and the article even goes into some of the ways. It just isn't cost-effective. Retiring the problematic machines would do it. I wonder if they can change the amount of money you play for in those machines, so that it's no longer worth it to try to cheat them?
matt_wulfeck 10y ago
It looks to me like a PRNG is fed once and never reseeded. That's the only way that simply observing the spin would tell about the outcome. In fact I'm surprised it doesn't just "produce" the outcome every time the button is hit simply from a few bytes of the prng.
- gspetr 10y ago
  As was said elsewhere in the thread: It seems that the organizer of this affair does not want his hired hands to figure out what's going on, telling them instead it's some computer magic they calculate real-time.
mirekrusin 10y ago
Why is it so difficult to create randomness? Input from microphone or even variations in electricity input should be more than enough, no? Why is it such a huge struggle, I don't understand, especially in machines that depend on the randomness.
- tomjen3 10y ago
  Those would be random, but not necessarily uniformly random (an input from a mic in a casino is going to register very loud noises often).
  - gspetr 10y ago
    Even so, how would one go about defeating such RNG?
    - triangleman 10y ago
      Oh I get it! If you can't prove that it's predictably random then you can't prove the outcome (house advantage) and then the casino won't buy the machine. Am I right?
- deelowe 10y ago
  There are several hardware RNG solutions available now that are truly random (based on physical phenomenon). But, these are older machines and maybe before security was taken so seriously.
Glyptodon 10y ago
I don't understand why this is wrong/illegal.
- digler999 10y ago
  because it's a threat to their business ?
  - Glyptodon 10y ago
    I mean sure, the business can kick them out, ban them, whatever, that's fine. I have no problem with that. What I have a problem with is the implication that using public information to succeed at something without any malicious interference in its operation could be a criminal matter.
LeonM 10y ago
Reminds me of the first chapter of Kevin Mitnick's 'The Art of Intrusion' [0]. The first chapter tells the story of (I believe) American programmers who reverse engineer the PRNG on a poker machine, so they could predict when the machine would deal the next royal flush. [0] https://www.amazon.com/Art-Intrusion-Exploits-Intruders-Deceivers/dp/0471782661 https://www.amazon.com/Art-Intrusion-Exploits-Intruders-Dece...
JCzynski 10y ago
I don't see why this is illegal, any more than counting cards in blackjack.
- Zanni 10y ago
  It's illegal because there's a law prohibiting the use of electronic devices to gain an advantage. If you could study the patterns offline sufficiently that you could use the same technique without a device in the casino, it would be legal.
- deleted 10y ago
  [deleted]
FabHK 10y ago
Don't know what PRNG they use, but for the Mersenne Twister (MT19937, which was considered state of the art the beginning of this millennium) for example you can deduce the state after 600 or so observations (of 32 bit words), and then predict what it'll deliver after that. See [1] for details and some good background on PRNG, if possibly a bit biased (she's promoting her PCG family). For gambling purposes, probably makes sense to use cryptographically secure PRNG :-) [1] http://www.pcg-random.org/predictability.html http://www.pcg-random.org/predictability.html
sageikosa 10y ago
Similar idea... https://en.wikipedia.org/wiki/Michael_Larson https://en.wikipedia.org/wiki/Michael_Larson
- gspetr 10y ago
  Great article and HN thread about this guy: https://news.ycombinator.com/item?id=9570713 https://news.ycombinator.com/item?id=9570713
justinpombrio 10y ago
By "Can't fix", they mean "could fix by putting in new slot machines whose PRNGs aren't crackable, but choose not to because it wouldn't be cost effective". Why don't slot machines use true random numbers? They could still skew the results however they like.
- imaginenore 10y ago
  why can't they simply update the firmware? A secure PRNG can be made trivially.
  - Scuds 10y ago
    sure it can. Now, implement it on a system from 2008 whose source and tooling has been scattered to the winds.
    - xorblurb 10y ago
      tons of people are working on video game console emulators, and that kind of people could do that easily...
droithomme 10y ago
That is a very interesting article. I disagree with the characterization of the crews as "cheaters". They didn't cheat. They turned a game of chance into a game of skill, then excelled at that skill. Of course this has happened to other games as well, such as with card counting in blackjack, which is also inaccurately described as cheating when it's actually mastery of the game.
Illniyar 10y ago
"Since code isn’t prone to sudden fits of madness..." Lol, I just can't stop laughing at that one.
grandalf 10y ago
This is the sort of use case that initially got me excited about Google glass.
kartan 10y ago
I see a lot of complains why this is illegal. It is illegal, as anything that it is illegal, because the law says so. As, for example, in Nevada: "NRS 465.075 Use of device for calculating probabilities. It is unlawful for any person at a licensed gaming establishment to use, or possess with the intent to use, any device to assist: 1. In projecting the outcome of the game; 2. In keeping track of the cards played; 3. In analyzing the probability of the occurrence of an event relating to the game; or 4. In analyzing the strategy for playing or betting to be used in the game, except as permitted by the commission." http://www.gambling-law-us.com/State-Laws/Nevada/ http://www.gambling-law-us.com/State-Laws/Nevada/
- FullMtlAlcoholc 10y ago
  The way gambling laws work is that any method that allows the consumer to consistently beat the odds (even if it has a winning rate of 50.00000001%) is illegal.
- dafty4 10y ago
  "any device to assist"... where the human brain is not a device? ;)
  - JimboOmega 10y ago
    Traditionally yes. This is why card counting (in your head) isn't illegal - though it can get you banned. Using a device to do the same thing for you IS illegal.
- windsignaling 10y ago
  There are a lot of things the law says are illegal that are completely ridiculous (a Google search will confirm this). The discussion is about whether those laws make sense and are moral, or if they were designed by greedy guys in suits trying to punish anyone who dares to play their game in a way different than intended.
  - EpicEng 10y ago
jcoffland 10y ago
> As Hoke notes, Aristocrat, Novomatic, and any other manufacturers whose PRNGs have been cracked “would have to pull all the machines out of service and put something else in, and they’re not going to do that.” This just goes to show that despite the money the casinos are losing to this Russian group, they are still making so much money off the people they are cheating that it's not worth fixing the problem. Why our governments protect the jerks who steal money from the less intelligent members of our society is beyond me. That there are laws that support casinos is no justification. Casinos are themselves a scam and should not be protected against scammers at the expense of tax payers.
- kartan 10y ago
  > Casinos are themselves a scam and should not be protected against scammers at the expense of tax payers. In Sweden casino gambling, and other types of gambling, is owned by the state. The state keeps the money from the gamblers. It is like an extra tax that people can choose by themselves. In Spain it is similar for Lottery, it moves a lot of money in Christmas and the state keeps the profits. Any country can achieve similar results applying high taxes to gambling. I think that forbidding gambling is an error, as it just moves it to more unsafe locations and opens good business for criminal organizations. Standards that regulate gambling are a better solution, it reduces gambling addiction creating less attractive gambling games, it forbids to loan money to gamblers while they are playing (that is really important), and in general keeps gambling in check. Disclaimer: I have worked in the gambling industry, and I will probably do it in the future.
- greggyb 10y ago
  Why our governments are the jerks who steal money from the less intelligent members of our society is beyond me. That there are lotteries in every state is no justification. Lotteries are themselves a scam and should not be protected against scammers at the expense of tax payers.
splonk 10y ago
> Allison notes that those operatives try to keep their winnings on each machine to less than $1,000, to avoid arousing suspicion. This is likely to be because they're trying to avoid the automatic W-2G that's generated for slot winnings over $1200. Basically if you're playing anonymously on a slot machine, any payout of $1200 or over on a single spin will generate a human interaction. Unless you're playing at fairly high stakes (say, over $100/spin), this is normally rare enough that hitting several $1200+ results in a short time span would be very suspicious. Keeping every win under $1200 allows a person to play as anonymously as you reasonably can in a casino.
andrewem 10y ago
Figuring out the pattern of a pseudorandom device used for gambling reminds me of Michael Larson, who learned the patterns used on a TV game show in order to win a lot of money. See https://en.m.wikipedia.org/wiki/Michael_Larson https://en.m.wikipedia.org/wiki/Michael_Larson
usgroup 10y ago
"Casino is entertainment for which you pay a probabilistic fee proportionate to your spend". Ok, a bit of a stretch, I personally think. I honestly think that people gamble on things like slots because they don't have an educated sense of probability. I'm not sure the transaction is quite as clean as buying a cinema ticket and trading cash for entertainment. "These guys were right to do it". I think the edge exists because it's ultimately illegal. I think it's tantamount to an illegal distribution of cash from a casino to a mob. Would it be any different if they hacked their bank account?
- audleman 10y ago
  > I honestly think that people gamble on things like slots because they don't have an educated sense of probability I once became an investor on a BitCoin gambling site. The operator let you either gamble, the normal route, or invest and receive a share of the payout. He was extremely clear about the house edge. I went into the chat room and asked people: why do you gamble if you know the odds are against you. The most canonical answer I received: "Maybe I believe my luck has an edge on the house"
broahmed 10y ago
I like how the guys were described as "scammers" and "cheaters"; the same adjectives could be used to describe the casinos.
shermozle 10y ago
I get that creating a genuine random number generator isn't easy, but surely this points out that it's something the slot machines should have rather than a PRNG?
neals 10y ago
After reading a bit about it, it seems very difficult (impossible?) to get a true random set of numbers. Anyboyd here on HN that has some insight? Are there interesting hardware or random-number-as-a-service things going on?
- ef4 10y ago
  There are a lot of people who make hardware random number generators: https://en.wikipedia.org/wiki/Comparison_of_hardware_random_number_generators https://en.wikipedia.org/wiki/Comparison_of_hardware_random_...
- DanBC 10y ago
  They used to be very expensive and of dubious quality. Now they're very cheap, but there's not much point in using them when we have better PRNGs. Some of them are not very good. Here's an old (2000) look at some hardware rngs and how they fail: http://www.robertnz.net/true_rng.html http://www.robertnz.net/true_rng.html
Girlang 10y ago
It's not that they can't fix it. It's simply that they won't fix it. It would be interesting to see if a Neural Network could find patterns in the PRNG quickly. Does any hacker have a decommissioned slot machine at home that we can experiment on?
thomyorkie 10y ago
> A finger that lingers too long above a spin button may be a guard’s only clue that hackers in St. Petersburg are about to make another score. Seems like this is easy for the scammers to work around. They could calculate the average time it takes for the scammer to lift his hand from his lap and press the button, and then use that time instead of .25 seconds. Would be less successful, but would seem to be almost impossible to detect.
brilliantcode 10y ago
Somebody play a tune on the world's smallest violin. People kill themselves because of casino normalizes self destructive behavior. So a bunch of impoverished engineers figure out a way to beat an outfit that profit's off from ripping people off. More power to them. I hope they take out all the fucking casino's ripping people off. Not that I condone hacking but casino really doesn't even register on my empathy list. Fuck them. It should be legal to burn money also because people love doing it at a swanky place like casinos. At least you won't see people get addicted to dousing your cash with gasoline and throwing a cigarette at it. I just thought of it and it seems quite exhilarating at the prospect....but it is safer and less addictive than gambling in casinos.
ommunist 10y ago
Really funny piece. It really feels like one of those Order vs Chaos battles, with Russians on the Order side. Guys found the order in randomness, I'd like to see the math behind their operational methodology. Also, why iPhone?
danbmil99 10y ago
Kevin Mitnick wrote about a similar hack over a decade ago: https://www.ethicalhacker.net/features/book-reviews/mitnick-the-art-of-intrusion-ch-1-hacking-the-casinos-for-a-million-bucks https://www.ethicalhacker.net/features/book-reviews/mitnick-... I knew some of the people involved and actually saw some of the code if anyone's interested.
thedailymail 10y ago
Anyone interested in how the gambling industry makes their billions mainly from slot machines, and how they engineer them to hijack people's dopamine systems should read Addiction by Design (MIT Press, 2012).
deavmi 10y ago
What an interesting world we live in.

391 points by arielm 10y ago

This is about as clickbaity as any headline can get

The "And Casinos Have No Fix" part of the title seems exaggerated; if nothing else, it appears that only a small subset of 5+ year old machines are affected.

fifnir 10y ago
And casinos can have people arrested over this so that's another fix
muninn_ 10y ago
Casinos HATE him!
rtkwe 10y ago
From the description of the attack it seems like the only reason other machines aren't affected is because the Russian group running this hasn't gotten their hands on those machines.
- goda90 10y ago
  It also mentions machines with encryption to prevent reverse engineering the PRNG.
  - hydrogen18 10y ago
    If that encryption works as good as other DRM and copy-prevention schemes, I'm sure it will protect the machine for at least 72 hours.
    - baobrien 10y ago
      eh, well designed CSPRNGs are a thing. If they re-seed/add to the entropy pool of the machines on the LSBs of microsecond button timing or something like that, it'll be pretty difficult to influence or predict the outputs.
- orclev 10y ago
  Sort of maybe. It sounds like the slot machine makers are being cheap with their machines. There are such things as hardware RNG that will produce a truly random number, it's just that for most applications they're overkill. This seems like an instance where not only aren't they overkill, they're almost mandatory. They talk a bit about using encryption to protect the PRNG algorithm, but that's just a bandaid, at best it buys them a little bit of time, but ultimately it will be cracked the same way. A hardware RNG is actually pretty cheap to make, there are actually open source (as in the circuit diagrams are available) ones floating around the internet that you can build for less than $20 worth of parts. The manufacturers probably don't want to go that far because a) compared to most of the parts in the machine it's a fairly expensive piece so it will cut into profits, b) hardware RNG function a bit different from a PRNG so properly integrating one requires a certain amount of skill, c) it isn't their problem really, they already got their money, it's the casinos that are losing, and d) it's simpler to just prosecute the handful of people doing this (for now).
  - cwmma 10y ago
    e) it's much harder to be sure a hardware RNG actually does produce random outputs compared to a PRNG
    - orclev 10y ago
      That was somewhat covered by point b, but yeah, in terms of verification it's tricky to determine if a hardware RNG is actually, you know, random. The other part that makes it tricky is that most hardware RNGs don't produce enough entropy to keep a system fed during active usage so you typically need to use their outputs as inputs to more traditional PRNGs or to periodically re-seed a PRNG which was actually the main thing I was thinking about with point b.
kyteland 10y ago
It absolutely is exaggerated. I left a job at a real money slot manufacturer 3-ish years ago where I was a mathematician and 'the rng guy'. Even then our machines weren't susceptible to this attack. We had a fix. And by 'weren't susceptible' I mean probably weren't but could be, because getting the rng wrong is super easy to do. Don't be shocked if regulators just pull these from the floor. They probably had to go through a lot of different machines from different manufacturers to find this in the first place.

Cyph0n 10y ago

It's still unclear how the organization broke the PRNG in the first place. Were they somehow able to get their hands on a machine for hardware analysis? Or did they just have their "operatives" play slots and capture video which they then manually analysed for patterns? Offloading the computation to a remote server is a smart idea though. There is a lot of cool stuff happening in the game cheating space.

Xylakant 10y ago
Yes they did. Says so in the article.
- Cyph0n 10y ago
  Ah, must have missed it.
tastythrowaway 10y ago
FTA it says that used machines proliferated at cheap prices after a 2009 country-wide ban on most forms of gambling.
- Cyph0n 10y ago
  I would assume that used machines are either destroyed by the manufacturer or resold only to licensed entities.
  - omgtehlion 10y ago
    Machines were sold in Russia, and at the day the gambling codex contained only one chapter: 1. Gambling is banned So, these casinos dumped machines as fast and as cheap as they can
  - throwaway2048 10y ago
    when gambling just got banned nationally, you have very little incentive to maintain good relations with the manufacturer, and would rather just get whatever you can moneywise for such a large investment.

moftz 10y ago

At what point does a scheme like this go from just being a way to outsmart the slot machine to felony fraud? I know you are allowed to use those blackjack cheat cards at the tables in Las Vegas but what if I started using a calculator and my own crazy algorithm? Is that fraud? What if I had an ear piece and hidden camera glasses to stream video to some blackjack guru outside in a van? I'm guessing that would be fraud. Is it the fact that he's using an outside source to determine his actions?

upofadown 10y ago
Here is a section of the Nevada gambling fraud law that hits close to a method that involves button timing: >7. To manipulate, with the intent to cheat, any component of a gaming device in a manner contrary to the designed and normal operational purpose for the component, including, but not limited to, varying the pull of the handle of a slot machine, with knowledge that the manipulation affects the outcome of the game or with knowledge of any event that affects the outcome of the game. In general you are not allowed to do anything clever in a casino. It isn't stated as such, but the actual crime is winning consistently. If you walk into a casino certain that you will not be providing the house with their cut then you will almost for sure run up against some law. Extra laws will be generated as required by the governments involved.
- usrusr 10y ago
  Key word being "knowledge". Seems like you are free to believe in any fantasy about you having an edge over the house, except when that belief happens to be true. The mere thought of having a streak of luck would make winning illegal. If thoughtcrimes were animals, this would be a cute little kitty.
  - Bartweiss 10y ago
    > Seems like you are free to believe in any fantasy about you having an edge over the house, except when that belief happens to be true. This is a pretty common pattern in "intent" crimes. As a simple example: attempted murder requires a potentially-effective plan. Shooting at someone and missing is attempted murder, burning a voodoo doll of them is not - no matter how sincerely you expect it to work. It does produce an odd situation where stupidity becomes a legal defense, but the basis for it is pretty understandable. It's not criminalizing being right, it's decriminalizing being wrong, presumably because it's too hard to define the boundaries of whether something useless was done with real intent.

CapacitorSet 10y ago

Saved you a click: the internal state of some slot machines' PRNG can be predicted after observing a few of its outputs.

artursapek 10y ago
I know I have read stories about this technique being used before. Doesn't it require special hardware and impeccable timing on your person to take advantage of it?
- matheweis 10y ago
  Article indicates that an iphone is the special hardware. It also handles the timing, even preemptively signals the player when to go based on his/her reaction time. Timing doesn't have to be perfect - only enough to offset the house edge.
  - macintux 10y ago
    Well, iPhone is the viewing mechanism for engineers on the other side of the world to do the real work.
    - netsharc 10y ago
      Interesting how they're doing it, I guess making an app with image recognition takes too much effort, and having all the logic in an app makes it easier for your fellow thief to go independent and not give you your cut. I guess an app that requires login would be possible.
      - macintux 10y ago
        IIRC the iPhone processing power is inadequate.
        bourbonfiber 10y ago

gwbas1c 10y ago

I wonder if there's enough variation in how people pull the handles and push the buttons that they could be used to partially re-seed the PRNG frequently enough that it the seed can't be determined by a video?

CapacitorSet 10y ago
That's the technique Linux uses, it feeds keyboard and mouse timing events into one of its entropy pools. I can't see why they wouldn't do this for slot machines.
- manarth 10y ago
  The article mentions newer slot machines, "whose PRNGs use encryption to protect mathematical secrets" - so new machines are already considered secure. Aristocrat, Novomatic, and any other manufacturers whose PRNGs have been cracked “would have to pull all the machines out of service and put something else in, and they’re not going to do that.” So they could be fixed, it's purely a financial decision. as long as older, compromised machines are still popular with customers, the smart financial move for casinos is to keep using them and accept the occasional loss to scammers.
  - lsaferite 10y ago
    Seems like using a radioactive decay RNG would also help, no?
    - thecatspaw 10y ago
      sure, but are you gonna put a tiny bit of radioactive material in every slot machine? Not to forget that the RNG would have to be restocked if the material ever runs out
      - orclev 10y ago
        Pretty sure the half-life of most things that would be used is already longer than the MTBF of just about every other part a slot machine.

bitexploder 10y ago

There is a fix and it is not crazy. The gist is they were able to brute force the PRNG of the machines and predict their future state. Hardware RNG is thr answer. In crypto it is obviously bad if someone can predict anything about your random values (keys / IVs). A hardware RNG, "cryptographically strong" RNG algorithms, and resetting the RNG very often make this problem go away.

klodolph 10y ago
You might be interested in seeing the legal requirements. Section 1.400: http://gaming.nv.gov/modules/showdocument.aspx?documentid=2919 http://gaming.nv.gov/modules/showdocument.aspx?documentid=29...
- bitexploder 10y ago
  That is a surprisingly detailed and reasonable requirement for the most part. Some of those side channel attack resistant requirements are wishful thinking in some ways, but it is also probably obvious in general, if someone is say, performing DPA in the middle of your casino.
bluGill 10y ago
The problem is that you cannot add a hardware random number generator to existing machines and the cost of buying a new machine is high enough that casinos do not want to do it. If the scammers get too big the casinos will replace the compromised machines and the scam ends. The scammers seem to know this: they are targeting more an more casinos around the world in an apparent effort to make sure it is worth the risk. Actually you don't need hardware random number generators. There is enough variance in human input to feed a cryptograhic random number generator. The code to add this probably wouldn't be that hard to write (they might be 8 bit CPUs or some such limit that makes it impossible though). However all code changes have to be certified by regulatory bodies (for good reason) which makes it not worth the effort to fix old machines.
- bitexploder 10y ago

ainiriand 10y ago

I would like to know what is morally wrong in defeating a system designed to beat you. Designed to (almost) always win. The Casino is the one that cheats because the odds are not completely random, as they should.

unwind 10y ago
I guess you're (as a player) supposed to know, understand, and support the fact that the house always wins. It is, after all, not free to build, staff and run a casino, so it would seem obvious that the money to do all that has to come from somewhere? You're simply not supposed to be able to win "too often". Sure, it would be better if it were truly a game of chance, I guess that's too difficult to deliver (and verify) at this point. Or, perhaps, the casinos prefer it this way of course. :)
- tnzn 10y ago
  Except Casinos design the distribution of gains so that you're manipulated into believing it'll be worth, even though you rationnaly know that it's no true.
  - stinkytaco 10y ago
    This could be said for many things: food, alcohol, mobile pay-to-play games, etc, etc. The whole advertising industry is built on making you believe something will be worth it, regardless of rational thought. Seems unfair to single out casinos.
    - sydd 10y ago
      Not really, because slots and other casino games are much more deceiving. The whole thing is engineered so that you believe that you will win lots of money. But the reality is very different, this is how they must be built: - There is a state sanctioned minimum payout rate. This differs by state, but its between 80-90%. This means that on average you lose 80-90% of the $$$ you put in. - Slot machines cannot use conditional probability, in other words spins are independent. This means that the machine has no "memory" each spin is like rolling a dice. You dont have higher chance of payout just because you didnt won anything during the last hour. I've worked for a big slots company and we analyzed our customers a LOT. The big players (AKA whales) who drop thousands per month are not bored rich people in 99% of the cases, they are average people like you and me with a bad gambling addiction. And the state or the casino companies are doing nothing to help these people (why would casino companies care? This is where they are most of their revenue from). This is totally different from other fields - imagine if cigarettes would be advertised as something that makes you healthy and the state would be OK with it.

ptero 10y ago

Funny (and sad) how something that could be praised as an ingenious trick a hundred years ago is now considered a crime that state spends serious effort to pursue. Cannot resist to reference an older perspective (from Smoke Bellew): http://www.online-literature.com/london/smoke-bellew/4/ http://www.online-literature.com/london/smoke-bellew/4/

LordKano 10y ago
That was a great story. A little long but still great.

eykanal 10y ago

Not knowing much about video jamming, is it possible to block this hack by attacking the cameras?

Cyph0n 10y ago
I read a paper on such a technique a while back. The CMOS sensors in smartphones are very sensitive to a certain band of infrared. I think it would be possible to set up a system that automatically detects smartphone location and splashes its general area with infrared. With a good controller and motor setup, you could probably have a single jammer that can alternate between multiple phones.
- joezydeco 10y ago
  And can be blocked with a small piece of infrared filter film.
  - Cyph0n 10y ago
    It depends on the threat model I guess. Whether or not such a system would work in a casino environment, I don't know.

jjuel 10y ago

The true fix is just to replace the machines. As they said the newer machines have encryption to hide the PRNG. Obviously some places can't do that, and the company is not doing it for free. So technically the casinos cannot fix the compromised machines themselves, but they could just replace them.

Retric 10y ago
If I know the PRNG and the encryption then I can predict the outcome of the encrypted PRNG. The encryption community has dealt with this issue for a long time and there are a lot of useful approaches, and many ways to fail.
- falsedan 10y ago
  > If I know the PRNG and the encryption then I can predict the outcome of the encrypted PRNG. I assume they are mixing the PRNG output with a secret key using some encryption algorithm. Given the cyphertext (observed spins) + the algorithm, you still can't predict numbers until you discover the key.
  - Retric 10y ago
    Depends on the algorithm. Many encryption schemes are vulnerable if you know the cyphertext and can guess the plain text. This is one of those cases where if they knew what they where doing the PRNG would be fine as is. So, you can't just and wave some undefined encryption scheme and assume they will implement it correctly.
    - Scaevolus 10y ago
      Any cryptographic hash function works as a key derivation function (KDF) or cryptographically secure pseudo-random number generator (CSPRNG). Even ones with broken collision resistance are probably still suitable-- you could just take the bottom bits of MD5(secret_key + counter) and that would be enough.

linohh 10y ago

For the german speaking; here's a documentary about a guy who did this in the late 70ies in Germany - without an iPhone, just by developing a feeling for the (back then) mechanical machines. https://vimeo.com/169617086 https://vimeo.com/169617086 Fun fact: §263a StGB (German penal code) was in part created to combat this kind of externally assisted prediction for slot machines. It is now punishable with up to five years in prison, if you just create or distribute the software up to three years.

aaossa 10y ago

How does that encryption work? Is like those sha-256 circuits used in Bitcoin mining? Is it possible to modify the affected machines to allow encryption?

y7 10y ago
Yes, using SHA-256 you can create a cryptographically secure PRNG. See https://en.wikipedia.org/wiki/Cryptographically_secure_pseudorandom_number_generator https://en.wikipedia.org/wiki/Cryptographically_secure_pseud...

Aardwolf 10y ago

Since the title says "Can't Fix": Isn't it fixable by injecting some entropy into the PRNG for every roll like button press durations in nanoseconds, temperature, hardware quantum based, ...?

mnw21cam 10y ago
Yes. That costs money, and requires the machine to be re-certified by the authorities.
digler999 10y ago
you'd have to do a hardware mod, and gaming is a regulated industry. so every mod you do has to be submitted to a state or nationwide gaming regulatory authority, takes months (at least) to get approval, and costs easily $100k. Not to mention full regression testing on the statistics of the game. You would have to "re-prove" the validity of the RNG , which requires another QA cycle, statistical expert, and game designer (to ensure that the frequency and distribution of wins matches the specification sheet)
- Aardwolf 10y ago
  Button timing might be doable with a software change only. Doesn't solve the other testing procedures of course. But what would be the difference with other casino software bugs then, are those also "Unfixable" then?
  - digler999 10y ago
    there aren't many other software bugs in casinos that affect the money. They're usually graphics-related or crashes, and they usually just restart the machine and write a bug report. If they are related to money, they pull the machine out of the field until a new software version is fixed. A gaming company I used to work at had an issue with multi-jurisdictional machines that worked in Mexico but could display english or spanish. The machines could also change denomination, say from $0.05 to $0.25. There was some bug where if you reset the power, you could get it to bump your credits up from 20 nickels to 20 quarters (or might have been 20 pesos to 20 cents), it was something dramatic and easily exploitable that was fixed promptly.

MR4D 10y ago

I would think that having 2 PRNGs and then switching between them would ruin this strategy. Obviously this would cost money for retrofitting, but all new slots could employ a new design, getting rid of this problem over a few years. Not a perfect solution, but at least it's a medium to long-term fix.

DashRattlesnake 10y ago
They already have a fix (better PRNGs), they just don't want to pay to implement it. "Use 2 PRNGs and switch between them somehow" sounds kinda like "roll your own encryption." This stuff is hard to get right, and iterating on quick-fixes without a deep understanding of the problem seems unlikely to do anything except introduce minor roadblocks for the attackers.

forgottenpass 10y ago

Slot machine outcomes are controlled by programs called pseudorandom number generators that produce baffling results by design. goddamnit wired. You're as bad as IT World. I don't know why I keep reading your trash.

bluejekyll 10y ago
They do an ok job of going on and explaining the limits of a PRNG. They're trying to target this to the broader market...
- shepardrtc 10y ago
  I generally agree, but "baffling results" is just plain stupid. Might as well start talking about internet "tubes".
amdavidson 10y ago
Is this statement not literally correct? I believe the person being baffled in this is the gambler not the programmer.
appleflaxen 10y ago
What do you object to in that sentence?
mturmon 10y ago
$ python Python 2.7.8 (default, Oct 19 2014, 16:03:53) >>> import random >>> random.random() 0.10294460164979391 Why??? What does it mean?

problems 10y ago

Curious how they screwed this one up - did they just have no proper random source? Nothing like modern operating systems use, like disk latency? If you're in the business of doing random numbers, you'd think you'd embed a cheap hardware based random number generator, even if it was extremely limited, just to seed a CSPRNG.

mark-r 10y ago
I'm guessing that proper hardware random sources, or the operating system entropy generators, are harder to verify by gaming commissions so they didn't get used. The article does mention that more modern software uses cryptographic generators that can't be predicted.

peapicker 10y ago

Change to roulette, chaos theory, and physicists -- using 8bit hardware in shoes -- and you get the fascinating book "The Eudaemonic Pie" by Thomas Bass. Highly recommended.

Zanni 10y ago
Came here to say the same thing. Brilliant book. A team of physicists created a computer to track a roulette ball and wheel with sufficient accuracy to gain a whopping 40% advantage over the house. Their hardware was never reliable enough (in terms of not catching on fire, the predictions were good) to make much money. Doyne Farmer, a member of the team basically invented the field of chaos theory, then went on to make a fortune on Wall Street.
- peapicker 10y ago
  I actually interned at Los Alamos Natl Lab at the Center for Nonlinear Studies while Doyne was there (late 80's - dating myself - before The Prediction Company). Cool guy! He had a nifty custom piece of hardware board for cellular automata in his computer that at the time blew me away. Was a cool job... got to write code that ran on things like Cray YMP supercomputers. Had a Thinking Machines CM-1 as well... (like in Jurassic Park with the blinkenlights).

technofiend 10y ago

A quick search of the inestimable comp.risks archives revealed this: http://catless.ncl.ac.uk/Risks/15/80#subj2 http://catless.ncl.ac.uk/Risks/15/80#subj2 Montreal -- Daniel Corriveau said he hopes that his 'victory over the system will give hope to others.' The computer analyst and his family received more than $620,000 [1C$ = U$0.75], including interest, from the Montreal casino yesterday, weeks after they overcame odds of one in six billion and beat an electronic keno game three times in a row." The author explains the following key points: o Corriveau used an "antique 286" computer to analyse 7,000 combinations from the keno game, [which uses an electronic pseudo-random number generator]. o Corriveau noticed that the electronic game was repeating numbers in a predictable pattern. o Corriveau and several family members bet on what they predicted would be due to come up; they won three times in succession. I had originally seen an article speculating someone power cycled a keno machine after recording the winning numbers, with the assumption or knowledge that the random number generator reseeded with a 0 on cold boot. I'm not sure if that's just me mis-remembering the details of this case, or another one altogether. If anyone has a link to the second case please let me know.

deleted 10y ago

[deleted]

RichardHeart 10y ago

Abusing humans desire to pattern find and take risks for profit is bad. Casinos are bad. If you could weaponize gambling and spread it in an enemy nation, you'd do much to hurt it's GDP. I made a video about why gambling sucks.

mark-r 10y ago

The title is a bit misleading (clickbait?) - the problem can certainly be fixed, and the article even goes into some of the ways. It just isn't cost-effective. Retiring the problematic machines would do it. I wonder if they can change the amount of money you play for in those machines, so that it's no longer worth it to try to cheat them?

matt_wulfeck 10y ago

It looks to me like a PRNG is fed once and never reseeded. That's the only way that simply observing the spin would tell about the outcome. In fact I'm surprised it doesn't just "produce" the outcome every time the button is hit simply from a few bytes of the prng.

gspetr 10y ago
As was said elsewhere in the thread: It seems that the organizer of this affair does not want his hired hands to figure out what's going on, telling them instead it's some computer magic they calculate real-time.

mirekrusin 10y ago

Why is it so difficult to create randomness? Input from microphone or even variations in electricity input should be more than enough, no? Why is it such a huge struggle, I don't understand, especially in machines that depend on the randomness.

tomjen3 10y ago
Those would be random, but not necessarily uniformly random (an input from a mic in a casino is going to register very loud noises often).
- gspetr 10y ago
  Even so, how would one go about defeating such RNG?
  - triangleman 10y ago
    Oh I get it! If you can't prove that it's predictably random then you can't prove the outcome (house advantage) and then the casino won't buy the machine. Am I right?
deelowe 10y ago
There are several hardware RNG solutions available now that are truly random (based on physical phenomenon). But, these are older machines and maybe before security was taken so seriously.

Glyptodon 10y ago

I don't understand why this is wrong/illegal.

digler999 10y ago
because it's a threat to their business ?
- Glyptodon 10y ago
  I mean sure, the business can kick them out, ban them, whatever, that's fine. I have no problem with that. What I have a problem with is the implication that using public information to succeed at something without any malicious interference in its operation could be a criminal matter.

LeonM 10y ago

Reminds me of the first chapter of Kevin Mitnick's 'The Art of Intrusion' [0]. The first chapter tells the story of (I believe) American programmers who reverse engineer the PRNG on a poker machine, so they could predict when the machine would deal the next royal flush. [0] https://www.amazon.com/Art-Intrusion-Exploits-Intruders-Deceivers/dp/0471782661 https://www.amazon.com/Art-Intrusion-Exploits-Intruders-Dece...

JCzynski 10y ago

I don't see why this is illegal, any more than counting cards in blackjack.

Zanni 10y ago
It's illegal because there's a law prohibiting the use of electronic devices to gain an advantage. If you could study the patterns offline sufficiently that you could use the same technique without a device in the casino, it would be legal.
deleted 10y ago
[deleted]

FabHK 10y ago

Don't know what PRNG they use, but for the Mersenne Twister (MT19937, which was considered state of the art the beginning of this millennium) for example you can deduce the state after 600 or so observations (of 32 bit words), and then predict what it'll deliver after that. See [1] for details and some good background on PRNG, if possibly a bit biased (she's promoting her PCG family). For gambling purposes, probably makes sense to use cryptographically secure PRNG :-) [1] http://www.pcg-random.org/predictability.html http://www.pcg-random.org/predictability.html

sageikosa 10y ago

Similar idea... https://en.wikipedia.org/wiki/Michael_Larson https://en.wikipedia.org/wiki/Michael_Larson

gspetr 10y ago
Great article and HN thread about this guy: https://news.ycombinator.com/item?id=9570713 https://news.ycombinator.com/item?id=9570713

justinpombrio 10y ago

By "Can't fix", they mean "could fix by putting in new slot machines whose PRNGs aren't crackable, but choose not to because it wouldn't be cost effective". Why don't slot machines use true random numbers? They could still skew the results however they like.

imaginenore 10y ago
why can't they simply update the firmware? A secure PRNG can be made trivially.
- Scuds 10y ago
  sure it can. Now, implement it on a system from 2008 whose source and tooling has been scattered to the winds.
  - xorblurb 10y ago
    tons of people are working on video game console emulators, and that kind of people could do that easily...

droithomme 10y ago

That is a very interesting article. I disagree with the characterization of the crews as "cheaters". They didn't cheat. They turned a game of chance into a game of skill, then excelled at that skill. Of course this has happened to other games as well, such as with card counting in blackjack, which is also inaccurately described as cheating when it's actually mastery of the game.

Illniyar 10y ago

"Since code isn’t prone to sudden fits of madness..." Lol, I just can't stop laughing at that one.

grandalf 10y ago

This is the sort of use case that initially got me excited about Google glass.

kartan 10y ago

I see a lot of complains why this is illegal. It is illegal, as anything that it is illegal, because the law says so. As, for example, in Nevada: "NRS 465.075 Use of device for calculating probabilities. It is unlawful for any person at a licensed gaming establishment to use, or possess with the intent to use, any device to assist: 1. In projecting the outcome of the game; 2. In keeping track of the cards played; 3. In analyzing the probability of the occurrence of an event relating to the game; or 4. In analyzing the strategy for playing or betting to be used in the game, except as permitted by the commission." http://www.gambling-law-us.com/State-Laws/Nevada/ http://www.gambling-law-us.com/State-Laws/Nevada/

FullMtlAlcoholc 10y ago
The way gambling laws work is that any method that allows the consumer to consistently beat the odds (even if it has a winning rate of 50.00000001%) is illegal.
dafty4 10y ago
"any device to assist"... where the human brain is not a device? ;)
- JimboOmega 10y ago
  Traditionally yes. This is why card counting (in your head) isn't illegal - though it can get you banned. Using a device to do the same thing for you IS illegal.
windsignaling 10y ago
There are a lot of things the law says are illegal that are completely ridiculous (a Google search will confirm this). The discussion is about whether those laws make sense and are moral, or if they were designed by greedy guys in suits trying to punish anyone who dares to play their game in a way different than intended.
- EpicEng 10y ago

jcoffland 10y ago

> As Hoke notes, Aristocrat, Novomatic, and any other manufacturers whose PRNGs have been cracked “would have to pull all the machines out of service and put something else in, and they’re not going to do that.” This just goes to show that despite the money the casinos are losing to this Russian group, they are still making so much money off the people they are cheating that it's not worth fixing the problem. Why our governments protect the jerks who steal money from the less intelligent members of our society is beyond me. That there are laws that support casinos is no justification. Casinos are themselves a scam and should not be protected against scammers at the expense of tax payers.

kartan 10y ago
> Casinos are themselves a scam and should not be protected against scammers at the expense of tax payers. In Sweden casino gambling, and other types of gambling, is owned by the state. The state keeps the money from the gamblers. It is like an extra tax that people can choose by themselves. In Spain it is similar for Lottery, it moves a lot of money in Christmas and the state keeps the profits. Any country can achieve similar results applying high taxes to gambling. I think that forbidding gambling is an error, as it just moves it to more unsafe locations and opens good business for criminal organizations. Standards that regulate gambling are a better solution, it reduces gambling addiction creating less attractive gambling games, it forbids to loan money to gamblers while they are playing (that is really important), and in general keeps gambling in check. Disclaimer: I have worked in the gambling industry, and I will probably do it in the future.
greggyb 10y ago
Why our governments are the jerks who steal money from the less intelligent members of our society is beyond me. That there are lotteries in every state is no justification. Lotteries are themselves a scam and should not be protected against scammers at the expense of tax payers.

splonk 10y ago

> Allison notes that those operatives try to keep their winnings on each machine to less than $1,000, to avoid arousing suspicion. This is likely to be because they're trying to avoid the automatic W-2G that's generated for slot winnings over $1200. Basically if you're playing anonymously on a slot machine, any payout of $1200 or over on a single spin will generate a human interaction. Unless you're playing at fairly high stakes (say, over $100/spin), this is normally rare enough that hitting several $1200+ results in a short time span would be very suspicious. Keeping every win under $1200 allows a person to play as anonymously as you reasonably can in a casino.

andrewem 10y ago

Figuring out the pattern of a pseudorandom device used for gambling reminds me of Michael Larson, who learned the patterns used on a TV game show in order to win a lot of money. See https://en.m.wikipedia.org/wiki/Michael_Larson https://en.m.wikipedia.org/wiki/Michael_Larson

usgroup 10y ago

"Casino is entertainment for which you pay a probabilistic fee proportionate to your spend". Ok, a bit of a stretch, I personally think. I honestly think that people gamble on things like slots because they don't have an educated sense of probability. I'm not sure the transaction is quite as clean as buying a cinema ticket and trading cash for entertainment. "These guys were right to do it". I think the edge exists because it's ultimately illegal. I think it's tantamount to an illegal distribution of cash from a casino to a mob. Would it be any different if they hacked their bank account?

audleman 10y ago
> I honestly think that people gamble on things like slots because they don't have an educated sense of probability I once became an investor on a BitCoin gambling site. The operator let you either gamble, the normal route, or invest and receive a share of the payout. He was extremely clear about the house edge. I went into the chat room and asked people: why do you gamble if you know the odds are against you. The most canonical answer I received: "Maybe I believe my luck has an edge on the house"

broahmed 10y ago

I like how the guys were described as "scammers" and "cheaters"; the same adjectives could be used to describe the casinos.

shermozle 10y ago

I get that creating a genuine random number generator isn't easy, but surely this points out that it's something the slot machines should have rather than a PRNG?

neals 10y ago

After reading a bit about it, it seems very difficult (impossible?) to get a true random set of numbers. Anyboyd here on HN that has some insight? Are there interesting hardware or random-number-as-a-service things going on?

ef4 10y ago
There are a lot of people who make hardware random number generators: https://en.wikipedia.org/wiki/Comparison_of_hardware_random_number_generators https://en.wikipedia.org/wiki/Comparison_of_hardware_random_...
DanBC 10y ago
They used to be very expensive and of dubious quality. Now they're very cheap, but there's not much point in using them when we have better PRNGs. Some of them are not very good. Here's an old (2000) look at some hardware rngs and how they fail: http://www.robertnz.net/true_rng.html http://www.robertnz.net/true_rng.html

Girlang 10y ago

It's not that they can't fix it. It's simply that they won't fix it. It would be interesting to see if a Neural Network could find patterns in the PRNG quickly. Does any hacker have a decommissioned slot machine at home that we can experiment on?

thomyorkie 10y ago

> A finger that lingers too long above a spin button may be a guard’s only clue that hackers in St. Petersburg are about to make another score. Seems like this is easy for the scammers to work around. They could calculate the average time it takes for the scammer to lift his hand from his lap and press the button, and then use that time instead of .25 seconds. Would be less successful, but would seem to be almost impossible to detect.

brilliantcode 10y ago

Somebody play a tune on the world's smallest violin. People kill themselves because of casino normalizes self destructive behavior. So a bunch of impoverished engineers figure out a way to beat an outfit that profit's off from ripping people off. More power to them. I hope they take out all the fucking casino's ripping people off. Not that I condone hacking but casino really doesn't even register on my empathy list. Fuck them. It should be legal to burn money also because people love doing it at a swanky place like casinos. At least you won't see people get addicted to dousing your cash with gasoline and throwing a cigarette at it. I just thought of it and it seems quite exhilarating at the prospect....but it is safer and less addictive than gambling in casinos.

ommunist 10y ago

Really funny piece. It really feels like one of those Order vs Chaos battles, with Russians on the Order side. Guys found the order in randomness, I'd like to see the math behind their operational methodology. Also, why iPhone?

danbmil99 10y ago

Kevin Mitnick wrote about a similar hack over a decade ago: https://www.ethicalhacker.net/features/book-reviews/mitnick-the-art-of-intrusion-ch-1-hacking-the-casinos-for-a-million-bucks https://www.ethicalhacker.net/features/book-reviews/mitnick-... I knew some of the people involved and actually saw some of the code if anyone's interested.

thedailymail 10y ago

Anyone interested in how the gambling industry makes their billions mainly from slot machines, and how they engineer them to hijack people's dopamine systems should read Addiction by Design (MIT Press, 2012).

deavmi 10y ago

What an interesting world we live in.